General
-
Target
2025-03-29_fab7377d0c225be7110b381bbbe53d2e_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
Sample
250329-rgc37avvf1
-
MD5
fab7377d0c225be7110b381bbbe53d2e
-
SHA1
3096dd62d5f3bcfaec2350e2e7484ddf4fea17b1
-
SHA256
402dfdbcdac8266fdde22e6a8ecc3ad6fd795aaacda7620c4b6ecd615864dd88
-
SHA512
89769c0cda927e2318ebf1b6b738040f4b723d05923194a515bdf406afd47845cd0f03e3828079bbcd4a81eabc20cd1a4ebce7b756987e0e49d31ae55c2714f5
-
SSDEEP
24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8a0ku:sTvC/MTQYxsWR7a0k
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-29_fab7377d0c225be7110b381bbbe53d2e_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-29_fab7377d0c225be7110b381bbbe53d2e_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
http://176.113.115.7/mine/random.exe
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
lumma
https://advennture.top/GKsiio
https://byteplusx.digital/aXweAX
https://travewlio.shop/ZNxbHi
https://skynetxc.live/AksoPA
https://pixtreev.run/LkaUz
https://targett.top/dsANGt
https://sparkiob.digital/KeASUp
https://appgridn.live/LEjdAK
https://cosmosyf.top/GOsznj
https://wxayfarer.live/ALosnz
https://70oreheatq.live/gsopp
https://0castmaxw.run/ganzde
https://weldorae.digital/geds
https://steelixr.live/aguiz
https://smeltingt.run/giiaus
https://ferromny.digital/gwpd
Extracted
quasar
1.5.0
Office04
goku92ad.zapto.org:5000
a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a
-
encryption_key
BF72099FDBC6B48816529089CF1CF2CF86357D14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Extracted
stealc
trump
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Targets
-
-
Target
2025-03-29_fab7377d0c225be7110b381bbbe53d2e_agent-tesla_black-basta_cobalt-strike_luca-stealer
-
Size
938KB
-
MD5
fab7377d0c225be7110b381bbbe53d2e
-
SHA1
3096dd62d5f3bcfaec2350e2e7484ddf4fea17b1
-
SHA256
402dfdbcdac8266fdde22e6a8ecc3ad6fd795aaacda7620c4b6ecd615864dd88
-
SHA512
89769c0cda927e2318ebf1b6b738040f4b723d05923194a515bdf406afd47845cd0f03e3828079bbcd4a81eabc20cd1a4ebce7b756987e0e49d31ae55c2714f5
-
SSDEEP
24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8a0ku:sTvC/MTQYxsWR7a0k
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Gcleaner family
-
Healer family
-
Lumma family
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
Quasar family
-
Quasar payload
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Creates new service(s)
-
Downloads MZ/PE file
-
Possible privilege escalation attempt
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Modifies file permissions
-
Windows security modification
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
6Windows Service
6Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
6Windows Service
6Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify Tools
5Modify Registry
8Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2